Category: Network Security Monitoring

Latest presos and blog posts: Malware traffic analysis with “Bro” and Catching “Bayas” on the wire

Posted on by Ismael Valenzuela

I don’t have to tell you how quickly life goes by. But I’m just amazed at the fact that it’s been more than 2 years without writing an entry in my blog! Not that I haven’t done anything interesting during this time though. Let me see… I moved to the “other side of the pond” (yup, that’s kind of a change!), I decided to take up my guitar lessons after many years… hey, I even took some cooking lessons for a few months! Hmm.. I wonder if this is a kind of pseudo early midlife crisis 🙂

Anyhow, on the professional side of things it’s been quite a productive time too. Although I already updated sections of my site to include some of this work, I wanted to share it here:

1. The slides from my talk “Catching Bayas on the Wire: Practical Kung-Fu to Detect Malware Traffic” presented at the 2013 SANS European Forensic Summit, are available on the Papers & Presentation page. A link to the updated version of this talk, presented in a BrightTalk Webinar on March 11th 2014 is there too.

2. My blog post “Identifying Malware Traffic with Bro and the Collective Intelligence Framework (CIF)” is posted on the Foundstone’s Open Security Research site. I’m specially happy and honoured to see that some of this work was more recently included in the latest version of the SANS 503: Intrusion Detection In-Depth class, after I had the privilege to teach the Bro section with Mike Poor and Judy Novak at SANS Orlando 2014. The pcap samples referenced in the post can be downloaded from my Github account.

3. More recently I was invited to participate as Guest Lecturer for the California Polytechnic State University in San Luis Obispo, teaching the Advanced Computer Forensic Methods & Tools class (part of the “Defense Against The Dark Arts” malware research course by McAfee/Intel Security). It was such a rewarding experience to teach to these motivated students!

Finally, I know quite a few people has been asking about Part 2 of the Android Memory Forensics post. Unfortunately something came up that prevented me from completing my work on this topic for more than a year. And by the time I had the opportunity to come back to this, so much had already changed that it didn’t make sense to continue writing the post along those lines. So my apologies for this. I promise I’ll get back to this topic, because it’s definitely a fascinating one.

Best I can probably do for now is to recommend a couple of good resources for you to check:

Talk to you soon!

When Prevention Fails: Extending IR and Digital Forensics to the Corporate Network (slides from SANS Boston 2011)

Posted on by Ismael Valenzuela

The slides from my @night talk at SANS Boston 2011 are available for download now:

When Prevention Fails, Extending IR and Digital Forensics Capabilities to the Corporate Network (PDF – 6,2 MB)

Speaking at SANS Boston

Thanks to Barbara Basalguete, Stephen Northcutt and the rest of the SANS crew for the opportunity to participate in such a great event, as well as to all the attendees that preferred to stay around after a long training day instead of heading off to Harvard Square for Friday party!

When Prevention Fails: Extending IR and Digital Forensics capabilities to the corporate network

2011 is being a big year for cybersecurity incidents with high profile attacks reported against large organizations including HBGary Federal, RSA, Lockheed Martin and several Sony companies among others. With smarter intruders that can make use of both very sophisticated attacks and simple, yet effective, phishing attacks against our users, everyone should assume that at some point their preventive measures will fail, and that sooner or later you will have to recover from a future intrusion. Based on this assumption several questions arise: When prevention fails, what is left? Am I ready to detect, react and recover from an intrusion? What can Network Security Monitoring and Digital Forensics do for me?

Ismael’s talk will address these questions, describing the latest trends in computer attacks and intrusions, including the use of Botnets and what has been called the Advanced Persistent Threats (APT). Lastly, Ismael will show how Network Security Monitoring (NSM) and Digital Forensics methods and tools can be extended to the corporate network to assist in the early detection and investigation of these threats. Best practices and techniques on how to do NSM, full packet capture, network forensic analysis and data carving will be discussed, along with some live demos using tools that are available to any security practitioner.

Teaching Community SANS Security 503: Intrusion Detection In-Depth

Posted on by Ismael Valenzuela

I’m glad to announce that I will be teaching Community SANS Security 503: Intrusion Detection In-Depth at Banbury, Oxfordshire (UK). This 6-day course will run from Monday, February 15, 2010 through Saturday, February 20, 2010.

If you haven’t heard of Community SANS courses before, I encourage you to have a look at this new format (new outside the US, where it’s been running for years). This is a great way of bringing the popular SANS courses to your local security community at a reasonable cost, especially for those that can’t attend the major events.  It’s worth mentioning that unlike the SANS Mentor  sessions, these are delivered over a six-day period, just like it is at a larger SANS event, including the full set of books and access to audio files. They are just delivered in your own community, in a small classroom setting and at a discounted cost for tuition and travel expenses.

I’ve already described my experience with SANS, both as student and facilitator, so I won’t go over that again. Also, you can find a further detailed description of the Security 503 track on SANS website, an outstanding course that I’ve already described as the “most valuable course I’ve ever taken”. However, I want you to listen to Mike Poor, instructor at the SANS Institute and co-author of this course (along with Judy Novak and Guy Bruneau), describing it on YouTube. Mike Poor is both an amazing professional and a great guy that I had the opportunity to meet at SANS Sydney in 2008, when I took his Penetration Testing class. As Mike would say, this IDS course is simply “awesome”!